Verizon Partner Program Data Protection

Data Protection Requirements

1. Definitions

• 1.1. “Business Data” means any information, including Personal Information, that a Program Member accesses, collects, retains, uses, discloses, or otherwise processes on behalf of Verizon pursuant to the terms of the Agreement[cite: 1]. This includes: (i) information provided directly from Verizon to the Program Member, (ii) information collected directly by the Program Member on behalf of Verizon, and (iii) information collected by the Program Member from any Verizon website via cookies, pixels, tags, and other similar technology and integrations[cite: 1].
• 1.2. “Law” or “Laws” means all laws, regulations, standards, regulatory guidance, and self-regulatory guidelines that may apply to Verizon or the Program Member[cite: 1]. This explicitly includes, but is not limited to, the CCPA, the CPRA, and other state data protection and data privacy laws, as supplemented by regulations or amended from time to time[cite: 1].
• 1.3. “Personal Information” means “personal data,” “personal information,” and “personally identifiable information”[cite: 1]. These terms mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, household, or device[cite: 1].
• 1.4. “Sell” and “Share” mean the descriptions set forth in the California Consumer Privacy Act (Cal.Civ.Code § 1798 et seq.) (“CCPA”) and the California Privacy Rights Act (“CPRA”)[cite: 1].
• 1.5. “Services” means collectively any services, products, or other deliverables a Program Member provides to Verizon under the Agreement[cite: 1].

2. Data Protection Terms

• 2.1. Compliance with Law: Program Members must comply with all Laws and protect Business Data by implementing the reasonable security procedures set forth in the Agreement[cite: 1].
• 2.2. Business Purposes and Data Limitations: Business Data is deemed to be Verizon Confidential Information[cite: 1]. Program Members must collect, retain, use, disclose, and process Business Data solely to fulfill obligations in providing Services to Verizon pursuant to the processing instructions in Schedule A, and for no other purposes[cite: 1]. In no circumstance shall a Program Member correct, augment, or combine Business Data with data acquired outside the business relationship with Verizon, whether from another entity or on its own behalf[cite: 1].
• 2.3. Derivative Uses and De-identification Criteria: Internal use of Business Data to improve Services is permitted only if the data is not used to perform services for another entity, or to build or modify household, consumer, or device profiles for any business other than Verizon[cite: 1]. Internal retention of de-identified or aggregated data is allowed only if the Program Member:
  • 2.3.1. Has implemented contractual and technical safeguards that prohibit re-identification of the consumer, household, or device[cite: 1];
  • 2.3.2. Has implemented business processes that specifically prohibit re-identification[cite: 1];
  • 2.3.3. Has implemented business processes to prevent inadvertent release of de-identified information[cite: 1]; and
  • 2.3.4. Makes no attempt to re-identify the information[cite: 1].
  Such data can only be retained for as long as permitted for standard Business Purposes[cite: 1].
• 2.4. Subprocessor Controls: Program Members may disclose Business Data to a subprocessor only if the subprocessor is bound by a written agreement containing terms no less restrictive than this Appendix[cite: 1]. The agreement must bind the subprocessor to assist the Program Member in responding to requests to access, correct, or delete Business Data[cite: 1].
• 2.6. Privacy Dashboard Integration & Customer Requests: Upon written request, Program Members must assist Verizon in responding to customer requests to access or delete data[cite: 1]. If a Program Member directly collects uniquely held Personal Information on Verizon’s behalf that is not otherwise transmitted to Verizon, the member must successfully integrate to Verizon’s Privacy Dashboard API in accordance with Verizon’s technical specifications prior to commencing the Services[cite: 1]. If a request is received directly from a customer, the member must forward it within five (5) business days to vzsuppliersprivacy@verizon.com, inform the customer they are acting as a service provider, and not respond with any data[cite: 1].
• 2.8. Prohibition on Selling or Sharing: Program Members shall not Sell or Share Business Data, nor retain, use, or disclose it outside the direct business relationship[cite: 1].
• 2.9. Duty to Inform and Remediate: Program Members must inform Verizon within five (5) business days if they are no longer able to comply with their legal data obligations[cite: 1]. Verizon reserves the right to take steps to ensure compliance and to stop or remediate unauthorized data processing[cite: 1].
• 2.11. Notices at Collection & Retention: Program Members must assist Verizon in ensuring a compliant notice at collection is provided to consumers, outlining exact retention criteria[cite: 1]. Personal Information may only be kept for the duration of the performance of Services, unless tax or legal obligations dictate otherwise[cite: 1].
• 2.13. Termination Clean-Up: At the conclusion of Services or termination of the Agreement, the Program Member must immediately delete, and cause its subprocessors to delete, all Business Data and provide a certification to Verizon unless legal retention applies[cite: 1].
• 2.14. Regulatory Notification: If a Program Member receives a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons relating to Verizon Business Data, it must notify Verizon within seven (7) days[cite: 1].
• 2.15. Mandatory Audits: Members must allow and cooperate with manual reviews, automated scans, and independent assessments conducted by Verizon or a qualified auditor at least once every twelve (12) months[cite: 1].

3. Schedule A: Data Processing Instructions and Intake Requirements

Program Members are required to fully document and complete all processing vectors in Schedule A before active engagement[cite: 1]. This includes details on the Program Member’s Point of Contact, Chief Privacy Officer, and comprehensive descriptions of the nature and business purposes of the processing[cite: 1]. It also requires identifying the categories of individuals (e.g., consumer customers, employees, or business representatives) and noting if any Sensitive Personal Information (SPI)—such as gender, location, biometrics, genetics, health, race, or criminal history—is being processed[cite: 1]. Security measures must, at a minimum, match the Verizon Information Security Requirements available at www.verizon.com/suppliers[cite: 1].

PRM Wireline Deal Registration, Access, & LOA Operations

1. Steps to Create and Submit a Wireline Deal Registration

Deal Registrations are structured Opportunities that require explicit Verizon approval[cite: 2]. They may be submitted provided the customer account exists in the system and does not require active account access approval[cite: 2].

• Step 1: Account Mapping – Complete a formal Wireline Account Search via the PRM portal[cite: 2]. On the search results page, select the “Register a Deal” hyperlink[cite: 2].
• Step 2: Relationship Mapping – If your company operates within a Master/Sub Agent framework, you will be prompted to define the exact interaction model:
  • Master Agent Options: (1) Select “No Sub Agent” if no external sub-agents are partnering on the opportunity; fields will default to your master account[cite: 2]. (2) Select “Sub Agent Search” to look up and link an active registered or non-registered sub-agent[cite: 2]. (3) Select “New Sub Add” if the sub-agent is missing from the list to populate required compliance fields[cite: 2].
  • Sub Agent Options: Select your primary Master Agent from the populated system selection tool and click OK[cite: 2].
• Step 3: Required Data Layout – The new deal registration page requires entry into the following data schema[cite: 2]:

• Step 4: Product Marketplace Entry – Save the core fields, then click on the “Marketplace” tab to locate products[cite: 2]. Select your products, enter the exact bookings data and product designators (if required), and save them to bind the items to your active deal configuration[cite: 2].
• Step 5: SLED Attestation – If the targeted customer account is structurally segmented as State, Local & Education (SLED), you must navigate to “Related” lists, click “New” under the SLED Attestation parameters, answer every compliance query, and click Save[cite: 2]. Skip this if the target is standard enterprise or mid-market[cite: 2].
• Step 6: Submission – Click the “Submit for Approval” action button located in the upper right workspace layout to officially route the opportunity for verification[cite: 2].

2. Third-Party Account Access Authorization Form Workflow

Per the updated November 2025 security compliance baseline, an authorized form must be on file from the end customer for all subagents disclosed as third-party Points of Contact (POCs) or Telecom Expense Managers (TEMs)[cite: 2]:

1. The fVPP Master or Sub Agent downloads the official third-party authorization form from the portal and sends it to the customer[cite: 2].
2. The customer fills out the data parameters and adds the exact partner agent company name[cite: 2].
3. The customer emails the finalized document directly to thirdpartypocupdate@verizonwireless.com[cite: 2].
4. Verizon reviews, registers the authorization, and confirms back to the customer that the agent is live as an approved Third Party[cite: 2].

To add a new subagent to the system with these access requirements, complete a Sub Agent Add PPCR and mark [Yes] in the Third Party POC/TEM field[cite: 2].

3. Executing a Wireline Letter of Authorization (LOA)

A Wireline LOA is a binding contract that authorizes a Verizon Partner Program Agent company and its designated Sub-Agents to perform operations and transact business with Verizon on behalf of an end customer[cite: 2]. To execute an LOA:

1. Navigate to “Account Search – Wireline.” If the account is available and listed as Shared, select the “Submit LOA” action button[cite: 2].
2. Map the Partner Account (your company), Customer Account, LOA Start Date, LOA End Date, and input the VPP ID or non-registered subagent entity name[cite: 2].
3. Click Save, then navigate to the “Related” tab and use the “Add Files” framework to upload the fully signed, executed LOA[cite: 2]. The system will automatically transition the file status to “Verified.” If no physical file is bound, the LOA remains invalid[cite: 2].

VPP New Logo Bonus Methods & Procedures

1. Purpose and Eligibility Thresholds

This procedure outlines the New Logo identification process required to claim a valid New Logo Bonus for VPP Program Members and their associated Channel Teams[cite: 3]. For purposes of this incentive program, a “New Logo” is defined strictly as an independent entity that has had no prior service history with Verizon, or has registered zero net billing with Verizon since January 1, 2024[cite: 3]. Subsidiaries of a corporate umbrella that already holds active services or billing with Verizon are explicitly excluded from this program[cite: 3].

2. Operational Submission Matrix

The systematic pipeline for registering and validating a New Logo entry depends on account origin[cite: 3]: